Data Processing Agreement

Last updated: 25 September 2026

Print or save as PDF

This Data Processing Agreement (“DPA”) forms part of the Outworx Terms of Service (the “Terms”) between Outworx Ltd, a company registered in England and Wales under company number 17006703, whose registered office is at 415c Margaret Powell House, Midsummer Boulevard, Milton Keynes, MK9 3BN, and registered with the UK Information Commissioner’s Office under registration number ZC186598 (“Outworx”, “we”, “us”), and the customer that has agreed to the Terms (“Customer”, “you”).

It applies automatically when you accept the Terms. You do not need to sign it, but if your firm needs a signed copy, email legal@outworx.ai and we will countersign one.

1. Definitions

• “Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, and, where it applies to you, the EU GDPR, each as amended or replaced from time to time.
• “Customer Personal Data” means personal data that we process on your behalf in providing the Service, as described in Annex 1.
• “Sub-processor” means a third party we engage to process Customer Personal Data.
• “Personal Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data.
• “Restricted Transfer” means a transfer of Customer Personal Data to a country outside the UK (or, where the EU GDPR applies, outside the EEA) that is not covered by an adequacy decision.

“Controller”, “processor”, “data subject”, “personal data” and “processing” have the meanings given in the Data Protection Laws. Other capitalised terms have the meanings given in the Terms.

2. Roles

For Customer Personal Data, you are the controller and Outworx is your processor. For the personal data we collect to run your account (such as your users’ login and billing details), Outworx is a controller and our Privacy Notice applies instead of this DPA.

You are responsible for having a lawful basis for the Customer Personal Data you give us, and for any notices you owe to your own clients and their staff and suppliers.

3. Processing on your instructions

We will process Customer Personal Data only on your documented instructions. Your instructions are the Terms, this DPA, and the settings and actions you take in the Service. We will tell you promptly if we believe an instruction breaks the Data Protection Laws. If the law requires us to process Customer Personal Data other than on your instructions, we will tell you before doing so, unless the law forbids it.

4. Our people

We will ensure that everyone we authorise to process Customer Personal Data is bound by a duty of confidentiality and has access only to the extent needed to provide the Service.

5. Security

We will implement appropriate technical and organisational measures to protect Customer Personal Data, taking into account the state of the art, the cost of implementation, and the nature and risks of the processing. The measures in place at the date of this DPA are described in Annex 2. We may update them, provided the overall level of protection is not reduced.

6. Sub-processors

• You give us general authorisation to engage the Sub-processors listed in Annex 3.
• We will give you at least 30 days’ notice before adding or replacing a Sub-processor, by email to your account’s admin address and by updating Annex 3.
• You may object on reasonable data protection grounds within that notice period. We will then work with you in good faith to find a solution. If we cannot, you may terminate the affected part of the Service and receive a refund of any prepaid fees for the period after termination.
• We will put a written contract in place with each Sub-processor that gives Customer Personal Data the same level of protection as this DPA. We remain responsible to you for our Sub-processors’ performance.

Third-party services that you choose to connect, such as Xero, QuickBooks Online, Microsoft OneDrive or your bank, are not our Sub-processors. We read data from them and send data to them on your instructions, and your own agreement with each provider governs how they handle it.

7. Helping you with data subject requests

Taking into account the nature of the processing, we will help you, through the Service’s features and otherwise, to respond to requests from individuals exercising their rights under the Data Protection Laws. If we receive a request directly that relates to Customer Personal Data, we will pass it to you without undue delay and will not respond to it ourselves except on your instructions.

8. Personal Data Breaches

We will notify you within 48 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data. Our notice will include, as far as we know at the time:

• the nature of the breach and the categories and approximate number of data subjects and records concerned;
• the likely consequences of the breach;
• the measures we have taken or propose to take to address it and limit its effects; and
• a contact point for more information.

Where we cannot give all of this at once, we will provide it in stages without undue delay. We will cooperate with you so that you can meet your own obligations to notify the ICO or other regulators and affected individuals. Notifying you of a breach is not an admission of fault or liability.

9. Impact assessments and regulators

We will give you reasonable help with any data protection impact assessment, and any prior consultation with the ICO or another supervisory authority, that relates to your use of the Service, taking into account the information available to us.

10. Deletion and return of data

When the Terms end, you can export your data from the Service for 30 days. After that, we will delete Customer Personal Data within 90 days, unless the law requires us to keep it. Data in backups is deleted as backups are overwritten in the normal backup cycle, and remains protected by this DPA until then.

11. Information and audits

We will make available to you the information reasonably needed to show that we comply with this DPA, including answers to reasonable security questionnaires. Where that information is not enough to demonstrate compliance, or where a regulator requires it, you (or an independent auditor bound by confidentiality) may audit our compliance, on the following terms:

• no more than once in any 12-month period, unless a regulator requires it or following a Personal Data Breach;
• with at least 30 days’ written notice, during UK business hours, and without unreasonable disruption to our business;
• at your own cost; and
• without access to other customers’ data or to information that would compromise our security.

12. International transfers

Customer Personal Data is hosted in the United Kingdom. Some Sub-processors process it elsewhere, as set out in Annex 3. We will make a Restricted Transfer only where it is covered by an adequacy decision or by appropriate safeguards under the Data Protection Laws, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses. You can request a copy of the safeguards that apply to a specific transfer.

13. Data from connected accounting platforms

We will not use Customer Personal Data, or any data we receive from Xero, QuickBooks Online or another platform you connect, to train, fine-tune, adapt or enhance any artificial intelligence or machine-learning model, whether our own or a third party’s. We will not sell that data, or aggregate it or supply it to any other app or third party, except to Sub-processors under this DPA.

14. Liability

Each party’s liability under this DPA is subject to the limitations and exclusions of liability in the Terms, except where the Data Protection Laws do not allow that.

15. General

• Duration. This DPA lasts for as long as we process Customer Personal Data for you.
• Order of precedence. If this DPA conflicts with the Terms, this DPA prevails in relation to the processing of Customer Personal Data.
• Changes. We may update this DPA to reflect changes in law or in our Sub-processors, and will give you notice as described in section 6 and the Terms. We will not reduce the protection this DPA gives Customer Personal Data.
• Governing law. This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Annex 1 — Details of the processing

• Subject matter and purpose: providing the Outworx bookkeeping automation Service: extracting data from documents, reconciling bank transactions, matching supplier statements, and posting records to the accounting software you connect.
• Nature of processing: collection (including importing documents from cloud storage you connect, such as OneDrive), storage, AI-assisted extraction, organisation, matching, retrieval, transmission to connected services on your instructions, and deletion.
• Duration: the term of the Terms, plus the deletion period in section 10.
• Categories of data subjects: your staff and users; your clients and their owners, directors and staff; suppliers, customers and other individuals named in the documents and transactions you process.
• Types of personal data: names, job titles, business and personal contact details, addresses, bank account details and transaction data, invoice, receipt and expense details, tax references, and any other personal data contained in the documents you upload.
• Special category data: none is intended. You should not upload special category data unless it appears incidentally in financial documents.

Annex 2 — Security measures

• Encryption in transit using TLS 1.2 or higher for all connections.
• Encryption at rest for the database and document storage.
• Hosting in AWS’s London region.
• Role-based access controls, so that only staff who need access to data have it.
• Multi-factor authentication for all administrative access.
• Regular vulnerability scanning and dependency monitoring.
• Encrypted backups stored in the same region with the same access controls.
• Audit logs for sensitive actions in the Service.
• OAuth-based connections to accounting platforms and banks; we never store your passwords for those services.
• A documented process for detecting, containing and reporting Personal Data Breaches.

Annex 3 — Sub-processors

Contact

Questions about this DPA, or requests for a signed copy, go to our Data Protection Officer at legal@outworx.ai.